CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/06/2022 |
| CVE-2022-1285 | 보통6.5 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8. | 01/06/2022 |
| CVE-2022-1464 | 보통5.4 | Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account . | 05/05/2022 |
| CVE-2022-0415 | 높음8.8 | Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6. | 21/03/2022 |
| GHSA-q347-cg56-pcq4 | 보통5.0 | SSRF in repository migration | 14/03/2022 |
| CVE-2022-0871 | 심각9.1 | Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5. | 11/03/2022 |
| CVE-2022-0870 | 보통5.3 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5. | 11/03/2022 |
| CVE-2020-14958 | 보통6.5 | In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check. | 21/06/2020 |
| CVE-2019-14544 | 심각9.8 | routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks. | 02/08/2019 |
| CVE-2018-20303 | 높음7.5 | In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925. | 20/12/2018 |
| CVE-2018-17031 | 보통6.1 | In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent. | 14/09/2018 |
| CVE-2018-15192 | 높음8.6 | An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. | 08/08/2018 |
| CVE-2018-15178 | 보통6.1 | Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go. | 08/08/2018 |
| CVE-2014-8683 | 보통4.3 | Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown. | 21/11/2014 |
| CVE-2014-8682 | 높음7.5 | Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly han | 21/11/2014 |
| CVE-2014-8681 | 높음7.5 | SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues. | 21/11/2014 |